attack.g0046 | Detection.FYI

Potential APT FIN7 POWERHOLD Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Read More
Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Read More
Potential APT FIN7 Related PowerShell Script Created

Aug 12, 2024 · attack.execution attack.g0046 detection.emerging-threats ·
Share on:

Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Read More
Potential POWERTRASH Script Execution

Aug 12, 2024 · attack.execution attack.t1059.001 attack.g0046 detection.emerging-threats ·
Share on:

Detects potential execution of the PowerShell script POWERTRASH

Read More
Suspicious Binary In User Directory Spawned From Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·
Share on:

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Read More